Commit b9662d6c44 for qemu.org

commit b9662d6c4452e8c1861e4201b232e97970f4eb35
Author: Bin Meng <bin.meng@processmission.com>
Date:   Tue Jul 7 16:34:20 2026 +0800

    hw/block: m25p80: Fix dummy byte handling for Winbond flash

    The m25p80 model uses s->needed_bytes to track how many bytes a
    controller must send after an opcode before the flash model can enter
    the data phase. For address-bearing commands this includes the address
    bytes. For fast-read commands it also includes the dummy phase.

    The tricky part is that flash datasheets describe the dummy phase in
    clock cycles, while the QEMU SSI interface advances the flash model one
    transferred byte at a time. The dummy clock count therefore has to be
    converted to the number of SSI bytes that the controller will actually
    emit.

    Some controllers have drivers that push these dummy bytes into a FIFO.
    Other controllers are programmed with a dummy-cycle count and generate
    the clocks themselves. The flash model still has to use the same byte
    count that a FIFO-style controller or the Linux spi-mem layer would use,
    otherwise the model waits too long and drops the first data bytes.

    Let's fix the inconsistency from the flash side first. We start from an
    easy one, the Winbond flashes.

    Per the Windbond W25Q256JV datasheet [1] instruction set table
    (chapter 8.1.2, 8.1.3, 8.1.4, 8.1.5), fix the wrong number of
    dummy bytes needed for fast read commands.

    [1] https://www.winbond.com/resource-files/w25q256jv%20spi%20revb%2009202016.pdf

    Fixes: fe8477052831 ("m25p80: Fix QIOR/DIOR handling for Winbond")
    Fixes: 3830c7a460b8 ("m25p80: Fix WINBOND fast read command handling")
    Fixes: cf6f1efe0b57 ("m25p80: Fast read commands family changes")
    Signed-off-by: Bin Meng <bin.meng@processmission.com>
    Tested-by: Cédric Le Goater <clg@redhat.com>
    Message-ID: <20260707083431.219671-2-bin.meng@processmission.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index 4a4cda6602..59ecb32c0a 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -1004,7 +1004,7 @@ static void decode_fast_read_cmd(Flash *s)
         s->needed_bytes += 1;
         break;
     case MAN_WINBOND:
-        s->needed_bytes += 8;
+        s->needed_bytes += 1;
         break;
     case MAN_NUMONYX:
         s->needed_bytes += numonyx_extract_cfg_num_dummies(s);
@@ -1099,7 +1099,7 @@ static void decode_qio_read_cmd(Flash *s)
     switch (get_man(s)) {
     case MAN_WINBOND:
         s->needed_bytes += WINBOND_CONTINUOUS_READ_MODE_CMD_LEN;
-        s->needed_bytes += 4;
+        s->needed_bytes += 2;
         break;
     case MAN_SPANSION:
         s->needed_bytes += SPANSION_CONTINUOUS_READ_MODE_CMD_LEN;